<html>
<head><meta charset="utf-8"><title>Paper: Präzi: Call-based Dependency Networks · wg-secure-code · Zulip Chat Archive</title></head>
<h2>Stream: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/index.html">wg-secure-code</a></h2>
<h3>Topic: <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html">Paper: Präzi: Call-based Dependency Networks</a></h3>

<hr>

<base href="https://rust-lang.zulipchat.com">

<head><link href="https://rust-lang.github.io/zulip_archive/style.css" rel="stylesheet"></head>

<a name="224606311"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/224606311" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Vytautas Astrauskas [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#224606311">(Jan 30 2021 at 21:36)</a>:</h4>
<p>FYI: There is a new paper on doing call-graph based dependency analysis for Rust: <a href="https://arxiv.org/pdf/2101.09563.pdf">Präzi: From Package-based to Call-based Dependency Networks</a>. The source code is available <a href="https://github.com/praezi/rust-emse-2020">here</a>.</p>



<a name="224779986"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/224779986" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#224779986">(Feb 01 2021 at 19:39)</a>:</h4>
<p>Neat! We were looking at Präzi awhile ago for call graph analysis. Glad to see there's been some more recent work on it</p>



<a name="224781707"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/224781707" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#224781707">(Feb 01 2021 at 19:54)</a>:</h4>
<p>There is a monetization opportunity in there. For example, run that combined with the advisory DB and flag projects that directly depend on vulnerable crates <em>and</em> actually call the problematic function. Immediate, actionable issue reports with very low false positive rate. Free for open-source, SaaS for everyone else.</p>



<a name="224781800"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/224781800" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#224781800">(Feb 01 2021 at 19:55)</a>:</h4>
<p>Too bad Firo Solutions didn't seem to advance beyond what the base <code>cargo-audit</code> offers, and their marketing is also unconvincing, to me at least.</p>



<a name="224796401"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/224796401" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#224796401">(Feb 01 2021 at 21:50)</a>:</h4>
<p>it'd be interesting to do this sort of call graph analysis in such a way that it can spit out a JSON report per crate/version, and then have <code>cargo-audit</code> be able to consume it in order to do false positive elimination</p>



<a name="224796428"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/224796428" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#224796428">(Feb 01 2021 at 21:50)</a>:</h4>
<p>Call Graph-as-a-Service</p>



<a name="225051225"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225051225" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225051225">(Feb 03 2021 at 17:37)</a>:</h4>
<p>/me downloads all 5GB of the latest Präzi CDN</p>



<a name="225051257"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225051257" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225051257">(Feb 03 2021 at 17:37)</a>:</h4>
<p>will be done in, uhh, 6 hours?(!)</p>



<a name="225151275"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225151275" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Vytautas Astrauskas [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225151275">(Feb 04 2021 at 12:16)</a>:</h4>
<p><span class="user-mention silent" data-user-id="132721">Tony Arcieri</span> <a href="#narrow/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks/near/225051257">said</a>:</p>
<blockquote>
<p>will be done in, uhh, 6 hours?(!)</p>
</blockquote>
<p>Looking forward to hearing about what you will manage to do with this data.</p>



<a name="225190014"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225190014" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225190014">(Feb 04 2021 at 17:04)</a>:</h4>
<p><span class="user-mention" data-user-id="116109">@Vytautas Astrauskas</span> I mainly just wanted to take a look at how it's structured/formatted</p>



<a name="225190041"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225190041" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225190041">(Feb 04 2021 at 17:05)</a>:</h4>
<p>our long-term goal would be something like false positive elimination in <code>cargo audit</code></p>



<a name="225190263"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225190263" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225190263">(Feb 04 2021 at 17:06)</a>:</h4>
<p>and for that it'd sure be nice if we could have separate <code>.json</code> files per crate/version which we could download on demand</p>



<a name="225192693"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225192693" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Vytautas Astrauskas [he/him] <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225192693">(Feb 04 2021 at 17:24)</a>:</h4>
<p>I see. Unfortunately, it seems that the authors are not in this Zulip. Let me try to poke them via email…</p>



<a name="225207698"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225207698" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225207698">(Feb 04 2021 at 19:13)</a>:</h4>
<p>Happy to chat on an email thread</p>



<a name="225823611"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225823611" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> jhejderup <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225823611">(Feb 10 2021 at 11:36)</a>:</h4>
<p>Thanks for sharing the paper here <span class="user-mention" data-user-id="116109">@Vytautas Astrauskas</span> !</p>



<a name="225824048"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225824048" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> jhejderup <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225824048">(Feb 10 2021 at 11:41)</a>:</h4>
<p><span class="user-mention" data-user-id="132721">@Tony Arcieri</span>: the dataset is quite large and will take up quite some space. Each call graph represents the package + its dependencies. I am still thinking of what would be a good way to make the dataset more accessible and queryable. Are there particular package releases that you are interested to look into? If you send me a list of releases (we have from Feb 2020 unfortunately ),  I can create a small zip-file to play around with.</p>



<a name="225824444"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225824444" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> jhejderup <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225824444">(Feb 10 2021 at 11:46)</a>:</h4>
<p>I would be very interested to have a chat about how we could use call graphs (or the call graph generator) with <code>cargo-audit</code>. I am also interested to know the broader security goals in <a href="http://crates.io">crates.io</a> and how Präzi could maybe fit in here.</p>



<a name="225843434"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225843434" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225843434">(Feb 10 2021 at 14:29)</a>:</h4>
<p><span class="user-mention" data-user-id="281841">@Robin Moussu</span> was working on something like this for rustdoc to visualize call graphs: <a href="https://github.com/robinmoussu/cargo-callgraph">https://github.com/robinmoussu/cargo-callgraph</a></p>



<a name="225843453"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225843453" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225843453">(Feb 10 2021 at 14:29)</a>:</h4>
<p>it would be neat to unify the projects somehow</p>



<a name="225851437"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225851437" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225851437">(Feb 10 2021 at 15:21)</a>:</h4>
<p><span class="user-mention" data-user-id="387642">@Joseph Hejderup</span> here's the tracking issue on <code>cargo-audit</code></p>



<a name="225851449"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225851449" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225851449">(Feb 10 2021 at 15:21)</a>:</h4>
<p><a href="https://github.com/RustSec/cargo-audit/issues/21">https://github.com/RustSec/cargo-audit/issues/21</a></p>



<a name="225851638"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225851638" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225851638">(Feb 10 2021 at 15:22)</a>:</h4>
<p>we currently track paths to functions which are affected by a particular vulnerability, although we have no linting that they're valid so the data may not be fully accurate</p>



<a name="225851758"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225851758" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225851758">(Feb 10 2021 at 15:23)</a>:</h4>
<p>but beyond that, when we flag a particular dependency as vulnerable, we'd like to be able to ensure that one of those functions appears in the call graph for the crate/workspace being audited in order to eliminate false positives</p>



<a name="225851788"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225851788" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225851788">(Feb 10 2021 at 15:23)</a>:</h4>
<p><span class="user-mention" data-user-id="232545">@Joshua Nelson</span> neat</p>



<a name="225864494"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225864494" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225864494">(Feb 10 2021 at 16:25)</a>:</h4>
<p><span class="user-mention" data-user-id="387642">@Joseph Hejderup</span> regarding the data set being large, I was wondering if it could be subdivided into a (large) git repo of per-package/version JSON files, and incrementally updated that way</p>



<a name="225864760"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225864760" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225864760">(Feb 10 2021 at 16:27)</a>:</h4>
<p>or just anything that serves HTTP. git really doesn't matter, but maybe you could host it on GitHub in a semi-verifiable way</p>



<a name="225865074"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225865074" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225865074">(Feb 10 2021 at 16:28)</a>:</h4>
<p>mostly it'd be nice to have client-side tooling that could download call graph analysis generated AOT, with on-demand access to the packages they care about</p>



<a name="225865240"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225865240" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225865240">(Feb 10 2021 at 16:28)</a>:</h4>
<p>in the case of <code>cargo-audit</code>, it has a <code>Cargo.lock</code> file to work from, so it knows the totality of packages which comprise the call graph</p>



<a name="225865969"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225865969" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225865969">(Feb 10 2021 at 16:31)</a>:</h4>
<p>What we'd like for <code>cargo-audit</code> to be able to do is download pre-generated call graph analysis for those (releases of) those packages in Cargo.toml, load that into a call graph data structure along with the local project, and be able to test that any of the listed vulnerable functions in a given advisory exist within the call graph for that project</p>



<a name="225932208"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225932208" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Robin Moussu <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225932208">(Feb 11 2021 at 00:09)</a>:</h4>
<p><span class="user-mention silent" data-user-id="232545">Joshua Nelson</span> <a href="#narrow/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks/near/225843434">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="281841">Robin Moussu</span> was working on something like this for rustdoc to visualize call graphs: <a href="https://github.com/robinmoussu/cargo-callgraph">https://github.com/robinmoussu/cargo-callgraph</a></p>
</blockquote>
<p>Yeah, I really need to restart working on it a bit, clean some stuff and give it more exposure when it will be in a good shape (it's currently in pre-alpha)!</p>



<a name="225975222"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225975222" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> jhejderup <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225975222">(Feb 11 2021 at 11:05)</a>:</h4>
<p><span class="user-mention silent" data-user-id="132721">Tony Arcieri</span> <a href="#narrow/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks/near/225864760">said</a>:</p>
<blockquote>
<p>or just anything that serves HTTP. git really doesn't matter, but maybe you could host it on GitHub in a semi-verifiable way</p>
</blockquote>
<p>This sounds like an awesome idea! I will start working on it next week. I created an <a href="https://github.com/praezi/rust-emse-2020/issues/3">issue</a> to keep track of the progress.</p>



<a name="225975843"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/225975843" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> jhejderup <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#225975843">(Feb 11 2021 at 11:11)</a>:</h4>
<p><span class="user-mention silent" data-user-id="232545">Joshua Nelson</span> <a href="#narrow/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks/near/225843434">said</a>:</p>
<blockquote>
<p><span class="user-mention silent" data-user-id="281841">Robin Moussu</span> was working on something like this for rustdoc to visualize call graphs: <a href="https://github.com/robinmoussu/cargo-callgraph">https://github.com/robinmoussu/cargo-callgraph</a></p>
</blockquote>
<p>That's really cool! <span class="user-mention" data-user-id="281841">@Robin Moussu</span> feel free to reach out to Kostas on <a href="https://github.com/ktrianta/rust-callgraphs">github</a>. He has been working on supporting static dispatch, dynamic dispatch (tricky using LLVM IR), and partial support for macro calls.</p>



<a name="226012942"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/226012942" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Shnatsel <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#226012942">(Feb 11 2021 at 16:00)</a>:</h4>
<p>With a service like that (i.e. remote and precomputed call graph, not requiring locally available source code) it would even be possible to apply it to analyzing binaries, e.g. <a href="https://github.com/Shnatsel/rust-audit">https://github.com/Shnatsel/rust-audit</a><br>
However, I fear that Cargo features will make this infeasible since the call graph may differ depending on the feature combination, and adding features quickly leads to a combinatorial explosion</p>



<a name="226083271"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/226083271" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#226083271">(Feb 12 2021 at 01:33)</a>:</h4>
<p><span class="user-mention" data-user-id="127617">@Shnatsel</span> I think it could be possible to do at least some degree of false-positive elimination, in either case, with no local analysis at all</p>



<a name="226083285"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/226083285" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#226083285">(Feb 12 2021 at 01:33)</a>:</h4>
<p>for transitive dependencies</p>



<a name="226083292"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/226083292" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#226083292">(Feb 12 2021 at 01:33)</a>:</h4>
<p>which seems to be the main place false-positive elimination would be nice</p>



<a name="228298403"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228298403" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> jhejderup <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228298403">(Mar 01 2021 at 20:14)</a>:</h4>
<p><span class="user-mention" data-user-id="132721">@Tony Arcieri</span> We have started to serve call graphs from our dataset at <a href="https://lima.ewi.tudelft.nl/cratesio/">https://lima.ewi.tudelft.nl/cratesio/</a>. I also made some brief documentation available <a href="https://github.com/praezi/rust-emse-2020/blob/main/rustsec/README.md">here</a> to get started. Other than simple checks, we haven't tried these call graphs for any application, so I would be happy to know if there is any missing or incomplete information.</p>



<a name="228440321"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228440321" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228440321">(Mar 02 2021 at 16:33)</a>:</h4>
<p><span class="user-mention" data-user-id="387642">@jhejderup</span> this is super cool! curious about this though:</p>
<blockquote>
<p>The available call graphs date back to February 2020; newer versions are currently not available</p>
</blockquote>



<a name="228440610"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228440610" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228440610">(Mar 02 2021 at 16:34)</a>:</h4>
<p>random thought: could something like <code>crater</code> generate this information continuously?</p>



<a name="228440687"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228440687" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228440687">(Mar 02 2021 at 16:35)</a>:</h4>
<p>that would be a <em>lot</em> of CPU days <span aria-label="sweat smile" class="emoji emoji-1f605" role="img" title="sweat smile">:sweat_smile:</span></p>



<a name="228440709"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228440709" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228440709">(Mar 02 2021 at 16:35)</a>:</h4>
<p>haha</p>



<a name="228440739"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228440739" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228440739">(Mar 02 2021 at 16:35)</a>:</h4>
<p>I'm wondering if it could be done incrementally as new crates are published</p>



<a name="228440880"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228440880" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228440880">(Mar 02 2021 at 16:36)</a>:</h4>
<p>is the idea that you look at all crates depending on this one to see if it meets the new version constraint? and generate a callgraph if so?</p>



<a name="228440899"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228440899" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228440899">(Mar 02 2021 at 16:36)</a>:</h4>
<p>that still sounds super expensive <span aria-label="sweat smile" class="emoji emoji-1f605" role="img" title="sweat smile">:sweat_smile:</span> imagine every time <code>syn</code> makes a release</p>



<a name="228441029"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228441029" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228441029">(Mar 02 2021 at 16:37)</a>:</h4>
<p>yeah it sounds tricky, but... <code>crater</code> is already downloading and compiling all of the crates continuously</p>



<a name="228441053"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228441053" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228441053">(Mar 02 2021 at 16:37)</a>:</h4>
<p>crater doesn't run continuously, only when someone queues a run</p>



<a name="228441079"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228441079" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228441079">(Mar 02 2021 at 16:37)</a>:</h4>
<p><a href="https://crater.rust-lang.org/">https://crater.rust-lang.org/</a></p>



<a name="228441083"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228441083" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228441083">(Mar 02 2021 at 16:37)</a>:</h4>
<p>well, yeah...</p>



<a name="228441126"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228441126" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228441126">(Mar 02 2021 at 16:38)</a>:</h4>
<p>so my concern is that the callgraph runs will take over the queue and leave no time for other runs</p>



<a name="228441222"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228441222" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228441222">(Mar 02 2021 at 16:38)</a>:</h4>
<p>there's already usually a week-long wait</p>



<a name="228463009"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228463009" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> jhejderup <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228463009">(Mar 02 2021 at 18:43)</a>:</h4>
<p><span class="user-mention silent" data-user-id="132721">Tony Arcieri</span> <a href="#narrow/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks/near/228440610">said</a>:</p>
<blockquote>
<p>random thought: could something like <code>crater</code> generate this information continuously?</p>
</blockquote>
<p>I like the idea of integrating it with <code>crater</code>; I will have to ask Kostas if it is both possible and feasible to do it without much effort</p>



<a name="228463604"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228463604" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> jhejderup <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228463604">(Mar 02 2021 at 18:46)</a>:</h4>
<p>We used a Docker+Kafka based setup to create a build pipeline last year if I recall correctly.</p>



<a name="228465693"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228465693" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228465693">(Mar 02 2021 at 18:59)</a>:</h4>
<p><span class="user-mention" data-user-id="232545">@Joshua Nelson</span> the other thing is the calculation doesn't need to be "on demand". it could potentially be done as an e.g. weekly job</p>



<a name="228465943"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228465943" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Tony Arcieri <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228465943">(Mar 02 2021 at 19:00)</a>:</h4>
<p>if we were to lint the <code>[affected.functions]</code> information against this database (for eventual consumption in <code>cargo-audit</code>), we'd just need it to include the crates that security advisories are being filed against, and usually advisories are filed against crates that have been out for awhile</p>



<a name="228466057"></a>
<h4><a href="https://rust-lang.zulipchat.com#narrow/stream/146229-wg-secure-code/topic/Paper%3A%20Pr%C3%A4zi%3A%20Call-based%20Dependency%20Networks/near/228466057" class="zl"><img src="https://rust-lang.github.io/zulip_archive/assets/img/zulip.svg" alt="view this post on Zulip" style="width:20px;height:20px;"></a> Joshua Nelson <a href="https://rust-lang.github.io/zulip_archive/stream/146229-wg-secure-code/topic/Paper.3A.20Pr.C3.A4zi.3A.20Call-based.20Dependency.20Networks.html#228466057">(Mar 02 2021 at 19:01)</a>:</h4>
<p>yes, that would be a lot easier</p>



<hr><p>Last updated: Aug 07 2021 at 22:04 UTC</p>
</html>